GDPR Compliance
Last updated: September 2026
Our Commitment
Khaki Thicket is committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains your rights and how we fulfil our obligations.
Data Controller
Khaki Thicket is the data controller responsible for your personal data. Our contact details are:
Khaki Thicket
27 Meadow Lane
Cheltenham, GL50 2JQ
United Kingdom
Email: [email protected]
Your Rights Under GDPR
Under data protection legislation, you have the following rights:
Right to Access
You have the right to request a copy of the personal data we hold about you. This is commonly known as a "subject access request". We will respond within one month of receiving your request.
Right to Rectification
You have the right to request that we correct any inaccurate personal data we hold about you. We will make corrections promptly upon verification of the inaccuracy.
Right to Erasure
You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purpose it was collected, or when you withdraw consent.
Right to Restrict Processing
You have the right to request that we limit how we use your personal data in certain circumstances, such as when you contest the accuracy of the data.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to Object
You have the right to object to processing of your personal data in certain circumstances, including processing for direct marketing purposes.
Rights Related to Automated Decision Making
You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you. We do not currently use automated decision-making.
Exercising Your Rights
To exercise any of these rights, please contact us at [email protected]. We may need to verify your identity before processing your request. We will respond to all legitimate requests within one month.
Lawful Basis for Processing
We process personal data under the following lawful bases:
- Contract: Processing necessary to fulfil orders and provide our services
- Legitimate Interests: Processing necessary for our business operations, provided your rights do not override our interests
- Consent: Processing based on your explicit consent, which you may withdraw at any time
- Legal Obligation: Processing required to comply with applicable laws
Data Security
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit
- Regular security assessments
- Access controls and authentication
- Staff training on data protection
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Retention periods are determined based on legal requirements, business needs, and the nature of the data.
International Transfers
We primarily store and process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place in accordance with data protection laws.
Complaints
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow, Cheshire
SK9 5AF
Website: ico.org.uk
Updates
This GDPR compliance information may be updated periodically. We encourage you to review this page regularly for any changes.